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This paper proposes a new protocol for quantum dense key distribution. This protocol embeds 
the benefits of a quantum dense coding and a quantum key distribution and is able to generate 
shared secret keys four times more efficiently than BB84 one. We hereinafter prove the security 
of this scheme against individual eavesdropping attacks, and we present preliminary experimental 
results, showing its feasibility. 
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I. INTRODUCTION 

Quantum dense coding (QDC) and quantum key dis- 
tribution (QKD) are two direct applications of funda- 
mental quantum mechanics, both involving two parties, 
Alice and Bob, exchanging some classical information. 

By QKD Alice and Bob exchange secret random keys 
to implement a secure encryption-decryption algorithm 
(one-time pad) without meeting, and the security of the 
distributed keys is based on the laws of quantum physics 
1 

Theoretically proposed in |2(, QDC basically doubles 
the capacity of transmission of a classical channel by lo- 
cal operations on one particle of the EPR pair shared by 
the two parties. QDC has received only partial experi- 
mental verification |3( using polarization entangled states 
of photons because of the inefficiently implemented Bell's 
state analysis y| and a lack of security in the transmitted 
information. 

Recently, Bostroem and Felbinger [j| gave birth to the 
original idea of a protocol encoding secure information by 
local operations on an EPR pair, though rather proposing 
a deterministic and secure transmission than implement- 
ing a truly dense coding scheme. 

In this paper we propose a protocol for the quan- 
tum dense key distribution (QDKD) including the ad- 
vantages of QKD and QDC in generating shared secret 
keys and enhancing transmission capacity. In Section 
II we present the protocol, in Section III we prove the 
security of QDKD against the individual eavesdropping 
attack, in Section IV the experiment proves the QDKD 
feasibility, and in Section V we discuss the practical ef- 
ficiency of the present protocol versus the most efficient 
QKD ones. 
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FIG. 1: QDKD scheme: particle B of an EPR pair I^ab) 
is sent from Alice to Bob and backward. Alice's and Bob's 
encoders selecting the local operation on particle (1b or Zb) 
together with the incomplete Bell's measurement by Alice es- 
tablish the key. Some pairs are randomly selected for non- 
local measurement (the anticorrelation check performed by 
spatially separated Alice and Bob measurements), as test of 
the transmission security. The more general eavesdropping 
attack is represented by the coupling of the EPR pair with 
a larger Hilbert space in the initial state |eE) by means of 
unitary operators Jbe and Kbe- 



II. QDKD: THE PROTOCOL 

The basic scheme of QDKD is presented in Fig. 1. 
Alice produces pairs of particles in the singlet state 
IV' ab) = tJj(|0a1b) — |1a0b)), and stores particle A in 

her lab, whereas she acts randomly with gate 1b or Z^ on 
particle B and then sends it to Bob. As Zb|0b) = |0b), 
and Zb|1b) = — |1b), Alice's random selection of gate 1b 
or Z-q encodes the bits of her secret key on the EPR pair, 
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with |^+ B ) = ^(|0a1b) + |1aOb». 

Bob randomly switches particle B towards either his 
measurement or his encoding apparatus. In one case 
Bob projects particle B on the base {|0b),|1b)} while 
in the other case, Bob, analogously to Alice, randomly 
acts with 1b or Z-q on particle B and then sends it back 
to Alice. When she receives it, her measurement appa- 
ratus performs an incomplete Bell's state analysis, i.e. 
a projection on IV'ab) or I^ab) °f the two-particle state 
composed by the previously stored particle A and par- 
ticle B. When Bob's apparatus projects particle B, Al- 
ice's measurement apparatus has to project particle A on 
the base {|0a}, |1a)} instead of performing a Bell's state 
analysis. As Alice prepares only states IV'ab) ano - IV'ab)' 
Alice and Bob results should be always anticorrelated. 
The anti-correlation check in Fig. 1, consists in compar- 
ing Alice and Bob results, and guarantees the security 
of the distributed keys against individual eavesdropping 
attack pj. 

After repeating this protocol enough times to produce 
the keys, Alice discloses the results of her measurements 
(IV'ab)' IV>ab)s I°a): |1a}) publicly exposing solely to the 
possibility of being monitored but not modified. Alice's 
measurements of IV'ab) ana - I^Aab) indicates the genera- 
tion of the keys. In fact because Bob is aware of Alice's 
measurement results (as well as of his own operation 1b 
or Zb)j he can extract the bit encoded by Alice and vice 
versa. Specifically, measuring IV'ab) means that Alice 
and Bob encoded and 1 or 1 and 0, respectively (Alice 
performed the operation 1b and Bob Zb or vice versa). 
The measurement of IV'ab)' histead, means that Alice 
and Bob encoded the same bit, or 1 (Alice and Bob 
performed the same operations on particle B, 1b or Zb). 

Thus, two keys are generated in this process, one pro- 
duced by Alice and one by Bob. The key generation is 
dense because any travelling particle B carries two ex- 
changed bits, one belonging to key A and one to key B. 

Since Alice's results, disclosed publicly, correspond 
to the sum (mod 2) of the bits of the two keys, i.e. 
OffiO = lffil = and 09 1 = IffiO = 1, a possible 
eavesdropper (Eve) on the public channel can intercept 
some information by correlating the two keys, though 
she does not get information on the single key. In other 
words, key B is used to encrypt key A and viceversa, and 
the results disclosed by Alice are the "encrypted key A" 
sent to Bob. In fact both keys are used twice, first to en- 
crypt the other key, and then to encrypt Alice and Bob 
messages. 

This obviously induces a lack of security if the 
one-time-pad protocol is implemented with both keys 
straightforwardly. For this reason only key A is used 
directly in the implementation of the one-time-pad pro- 
tocol. The discussion on how Alice and Bob can lower 
Eve's information on key B in order to generate a " new" 
secret key B is a typical task in the field of computer 
science and it is outside the scope of this paper. 

Here we simply observe that Eve does not have any 



direct information on the single key but only on the cor- 
relation between the random bits in specific position of 
the two keys. If Alice and Bob have common secret algo- 
rithms for the permutation of the position of the bits of 
one of the two key (e.g. key B), they can strongly reduce 
Eve's information on the two key. To guarantee the com- 
plete security of the encrypted message we suggest to use 
only key A for the one time pad, while the scrambled key 
B can be used as a source for a cipher to generate a new 
key. 

III. QDKD: THE SECURITY PROOF 

Let's consider now the individual Eve's attack (Fig. 1) 
consisting in coupling particle B with an ancilla system 
in the initial state |ce) by means of a general unitary 
operator Jbe- The Hilbert space A-B is widened by cou- 
pling with the N-dimensional Hilbert space E of the an- 
cilla system. After Bob's operations, Eve couples again 
her ancilla to system A-B by applying another unitary 
operator -Kbe- Eventually she performs any POVM mea- 
surement allowed by the laws of quantum mechanics on 
the ancilla system E. Note that this approach is general 
because any physical non-unitary interaction is equiva- 
lent to a unitary one with a higher dimensional ancilla 
space We represent the coupled system A-B-E after 
Bob's and Eve's operations as 

#be1b</be|^ab) ® l e E) = I/4be)> 

-^beIbJbeIV'ab) ® I 6 e) = IMabe)) 

JsTbeZbJbeIt/'ab) ® l e E) = I^abe)' 

JsTbeZbJbeIV'ab) ® l e E) = I^abe)- ( 2 ) 

As Alice prepares only states IV'ab)' with probability ^, 
the results of the anti-correlation check performed by Al- 
ice and Bob should always be anticorrelated. Eve's action 
induces a bit flip on particle B giving correlated results. 
This is basically the signature of Eve's presence. 

We estimate now the probability P CO rr of correlated 
results in the anti-correlation check 

Pcorr = tr[J B EPAB ® |^e) (ce I Jqe C^OO + ^ll)L ( 3 ) 

where P 00 = |0 a 0b)(0a0b|^ Ai = |1a1b)(U1b| are 
projection operators and pab = 1/2|' ( /'ab){' ! /'abI + 
1 / 2\%P~p lB ) (ipp^l . From Eq.s J2J an( i the properties of uni- 
tary operators i^BE and Jbe, it can be demonstrated that 

P corr = -(1 + (MaBeKbe))- ( 4 ) 

The mutual information I s:r between the sender (s), 
preparing and sending states p n with probability p n , and 
the receiver (r) satisfies the Holevo bound 

I S :r < 2"s:r = S(j)) - ^ p n S (p n ) , (5) 
n 
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FIG. 2: Plots of Ib-.e (a) and Ta:E (b) versus P COJ r and q. 



where S(p) is the Von Neumann entropy Q of the generic 
state p, and p = J2 n PnPn- Note that, even if the receiver 
performs the more general POVM measurements on the 
quantum state p, there is no guarantee that he can reach 
the Holevo bound T S:I . 

Following the same argumentation leading to Eq. JIJ, 
the Holevo bounds Ib-.e and Ia-.e are expressed in terms 
of P corr and q = (^abeI^abe)- Fi S- 2 P lots ^BiE and 
2a:E versus P corr and q, showing that the anti-correlation 
check provides an estimate of the maximum information 
obtainable by Eve. From this estimate Alice and Bob es- 
tablish the security level of the bits exchanged. This also 
implies that Eve cannot avoid to disclose herself when at- 
tacking individually the qubit on the quantum channel. 

Moreover Eve's possibilities have been overestimated 
in deriving Ib-.e and Ia-.e- In fact Eve is assumed to 
perform any POVM on the final state of the whole system 
A-B-E. This is obviously not the CBjSC, c.IS she can perform 
any POVM on the final state of her system E, but on 
system A-B she only knows the results disclosed during 
the public discussion. 

In any practical implementation of QKD protocols, Al- 
ice and Bob distill from the noisy and possibly insecure 
key a nearly noise-free and secure key by means of er- 
ror correction and privacy amplification |8j. Alice's and 
Bob's capability of recovering two secure cryptographic 
keys (key A and key B) on the face of Eve's presence, is 
given, though in some cases too restrictively 9|, by the 




FIG. 3: QDKD set-up: photon pairs are generated by SPDC 
in type II nonlinear crystal (NLC2) pumped by the pulsed 
laser system (GL, Ti:Sa and NLC1). The bits of the keys are 
encoded in the phase of the entangled state by means of half- 
wave plates (HWPs). The incomplete Bell's state measure- 
ment is performed with an interferometer analogous to the one 
used in [3J, consisting of a 50:50 beam splitter (BS), interfer- 
ence filters (IFs), fiber couplers, fibers integrated polarizing 
beam splitters (PBS), single-photon detectors. M stands for 
mirror, DM dichroic mirror, L lens, CC birefringence com- 
pensation crystals. 

condition 7a:B > Ia-.e and Ia-.b > Ib-.e |10|. where Ia-.b is 
the mutual information between Alice and Bob. 7a:B can 
be simply calculated considering the capacity of a noisy 
channel of quantum bit error rate Q, as Ja : b = 1 — H(Q), 
where H is the Shannon entropy of a binary channel • 
To ensure the security of the two generated keys, we re- 
place 7a:E and Ib-.e with the maximums of 2a:E and Ib-.e 
found in q = 0, for any P CO rr- Regardless differences in 
functions 2a:E and Ib-.e, it has been demonstrated that 
2a:e| 9 =o = 2b:e|<?=o = H(P C orr) for any values of P corr . 
This means that Alice and Bob can distill common secret 
keys when 

H{Q) + H(P corr ) < 1. (6) 



IV. QDKD: THE EXPERIMENT 

We implemented experimentally a proof of principle of 
QDKD protocol by the scheme of Fig. 3. 

The source of entangled photons in a singlet state is 
a 0.5 mm long BBO nonlinear crystal (NLC2) pumped 
by ultrashort pulses (150 fs) at 415 nm from a second 
harmonic (obtained from NLC1) of a ultrashort mode- 
locked Ti-Sapphirc with repetition rate 76 MHz pumped 
by a 532 nm laser (GL). NLC2 realizes a non-collincar 
type II phase matching, to obtain polarization entangled 
state \ip~) at 830 nm, where 10) [|1)] stands for hori- 
zontal [vertical] polarization [13. Alice's bit encoding 
procedure consists in taking on and off, in the quan- 
tum channel B, an half-wave plate (HWP) with optical 
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axis parallel to the horizontal polarization state. Accord- 
ing to Eq. the HWP on means Alice's encoding bit 
1, while off corresponds to bit 0. The same holds for 
Bob's encoding apparatus. The Bell's state analyzer is 
a Hong-Ou-Mandel interferometer 13] together with two 
polarization-measurement systems. To compensate for 
the optical delays in the interferometer the 50:50 beam 
splitter (BS) is mounted on a micrometric translation 
stage. The anti-correlation check consists in polarization 
measurements performed separately by Alice and Bob 
on photons A and B respectively, when photon B is re- 
flected by Bob's BS towards his detection apparatus. As 
a matter of fact Bob decides the ratio of pairs devoted 
to this measurement since the reflectivity of his BS sends 
randomly some photons B towards his polarization mea- 
surement system. Note that Alice's Bell-state-analyzer 
is also suitable for polarization measurement, namely for 
the anti-correlation check. Alice's and Bob's detection 
apparatuses are composed by open air-fiber couplers to 
collect the down-converted light in single-mode optical 
fibers. The detection of photons according to their po- 
larization is guaranteed by a fiber-integrated polarizing 
beam splitter (PBS). Photons at the two output ports of 
PBS are sent to fiber coupled photon counters (Perkin- 
Elmer SPCM-AQR-14). These are indicated as lh, lv, 
2h, and 2v in the Alice's detection apparatus, and as Bh 
and Bv in the Bob's anticorrelation check. Interference 
filters (IF, at 830 nm, 11 nm FWHM) are placed in front 
of the fiber couplers to reduce stray- light. 



Fig. 4 shows the interference profiles when both Alice 
and Bob encode bit (a) , Alice encodes bit 1 and Bob bit 
(b), both Alice and Bob encode bit 1 (c). Cases (a) and 
(c), corresponding to a final state |Vab)> present peaks in 
the coincidence counts from detectors lh 2v or lv 2h and 
dips in the coincidence from detectors lh lv or 2h 2v, 
since |Vab) ^ s spatially antisymmetric. By contrary case 
(b), corresponding to the spatially symmetric final state 
IV'ab)' presents the complementary behavior. When the 
paths of photons A and B differ more than their coher- 
ence length, no interference occurs, and one obtains clas- 
sical statistics for the coincidence count rates at the de- 
tectors. For optimal positioning of BS, i.e. indistinguish- 
able photon paths, interferences enables Alice and Bob 
to read the encoded information. We measured V corr as 
the ratio between the sum of coincidences from detectors 
Bh lh and Bv lv corresponding to correlated results, and 
the sum of coincidences between Bh lh, Bv lv, Bh lv, 
and Bv lh, corresponding to both correlated and anticor- 
related results. We obtained P corr < 0.05. The presence 
of correlated counts together with the reduction of the 
visibility of the interferometric profiles are basically due 
to losses in optics, detection, electronics, and noise [Tij . 
From the visibility in Fig. 4 we estimated Q = 3.3%, and 
according with Eq. © if (0.033) + if (0.05) = 0.49 < 1. 



V. FURTHER DISCUSSION 

According to Ref. the theoretical efficiency of a 

QKD protocol is defined as £ = b s /(q t +b t ), where, for 
every step, b s is the expected number of secret bits ex- 
changed by the two parties, qt is the number of qubits 
exchanged on the quantum channel, and b s is the num- 
ber of bits exchanged on the public channel. Any QKD 
protocol satisfies £ < 1, while DQKD reaches the limit 
value £ = 1 as b s = 2, q t = 1 and b t — 1, and the bits 
used for eavesdrop checking are neglected jljj . 

To our knowledge only two other protocols reach the 
limit value of £ = 1, one proposed by Cabello (high ca- 
pacity Cabello protocol, HCCP) [Tjj, and one by Long 
and Liu (high capacity Long Liu protocol, HCLLP) |16| . 
Both protocols exploit the fact that a possible eavesdrop- 
per, with no access to the whole quantum system at the 
same time, cannot recover the whole information with- 
out being detected, and both employ a larger alphabet, 
a four dimensional orthogonal basis of pure states. 

HCLLP appears hardly implementable as the detec- 
tion system should perform a complete discrimination 
between the four Bell's states (4|. As to HCCP the de- 
tection system is completely analogous to the interfer- 
ometer implemented in the DQKD experiment. On the 
contrary, in DQKD the source of photons and the encod- 
ing apparatuses are quite simple (a type II parametric 
down-conversion (PDC) source and two local operations), 
while they are much more complicated in HCCP, where 
they could be implemented by using a system to switch 
between two PDC sources (one type I, and one type II) 
and three local operations. In conclusion DQKD is a new 
maximally efficient QKD protocol fully exploiting QDC 
instead of a larger alphabet, and incorporating the prac- 
tical advantages of HCCP and HCLLP. 

In order to evaluate the effective potential applications 
of DQKD we analyze the effects of losses, considering the 
length L of the communication channel between Alice 
and Bob. As the photon sent from Alice to Bob and 
backwards travels over a distance 2L, the other photon 
of the pair should be stored by Alice for a time 2L/c (c is 
the speed of light in the quantum channel) , for example 
in a storage fiber ring of length 2L. Thus, for DQKD 
the two photons should be kept decoherence-free for a 
time 2L/c, as for HCCP, while for HCLLP they should 
be kept decoherence-free for a time 3L/c. 

In this respect we define a probability V that a pho- 
ton is transmitted over the distance L ^3- The prac- 
tical efficiency, 77, of a QKD protocol can be evaluated 
by the product between the theoretical efficiency £ and 
the probability that the photons are not lost in the com- 
munication channels. In the case of DQKD (as well as 
of HCCP) 77 = V 2 V 2 1 because both photons travel for a 
time 2L/c. In the case of BB84 protocol d ry = 0.25P, 
as there is only one photon travelling for the path L, 
and the theoretical efficiency is only £ = 0.25. An op- 
timized version of the BB84 exploits the possibility that 
Bob measures the photon sent by Alice only after Al- 
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FIG. 4: Coincidence rates obtained from pairs of detectors 
lh, 2v or lv, 2h (open square), and lh, lv or 2h, 2v (circle) 
versus the displacement of the beam splitter. 



ice has disclosed the measurement basis. In this case 
£ = 0.5, but after travelling for the distance L, the pho- 
ton should be stored by Bob for an additional time L/c, 
waiting for Alice classical bits, resulting rj = 0.5V 2 . 

Eventually, the practical efficiency of a QKD proto- 
col depends on the quality of the quantum channel: if 
V > 71% the most efficient protocols is still DQKD (as 
well as HCCP), if 50% < V < 71% the more efficient is 
the optimized BB84, while if V < 50% the best perfor- 
mance are obtainable by the original BB84 protocol. For 
example, if we consider 1550 nm commercial telecommu- 
nication fiber, whose attenuation factor is 0.2 dB/km, 
DQKD protocol is more efficient than BB84 protocols 
for distance L shorter than 7.4 km, for L > 15 km the 
most efficient is the original BB84, while for intermedi- 
ate distances the more suitable choice is the optimized 
BB84. However, the forthcoming advent of a new gen- 
eration of optical fibers, such as photonic-cristal fibers 
(PCF) and Bragg fibers with predicted attenuation fac- 
tors between 10~ 2 dB/km and 10~ 4 dB/km or less, will 



lead DKQD protocol advantageous over much longer dis- 
tances, namely up to L ~ 150 km corresponding to at- 
tenuation of 10~ 2 dB/km and up to L ~ 15000 km for 
attenuation of 10~ 4 dB/km. 



VI. CONCLUSION 

In conclusion the proposed protocol embeds the main 
advantages of two quantum communication applications, 
namely QKD and QDC, as it allows the generation of 
secure cryptographic keys using only one travelling-qubit 
for two bit of classical information. 

The protocol has been proved to be secure against in- 
dividual eavesdropping attack by using a non-local mea- 
surement. We proved also that QDKD reaches the max- 
imum of the efficiency of QKD protocols. 

We performed a experimental implementation estab- 
lishing the conditions for a secure QDKD. The experi- 
ment in fact proved the feasibility of QDKD by showing 
high- visibility interferometric profiles as well as low-noise 
anticorrelation check. This is only the proof of principle 
of the system described above for QDKD, as we are aware 
that the actual system is not yet fast enough in switch- 
ing the encoding operations. We are now focused on the 
realization of fast switching Zb gates by using PockelTs 
cells and HWPs. 
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